Endpoint Standard: 9th February 2021: Microsoft Office temp files being identified as Potential Malware.

[#1]

Environment

• Carbon Black Cloud Console : All Versions
• Endpoint Standard Sensor: 3.6.0.1897 and above
• Microsoft Windows: All Supported Versions
• Microsoft Office

Symptoms

• On the 9th of February 2021, Microsoft Office temporary files started being blocked.
• These files were alerted in the console as 'Potential Malware'. 
• This issue is affecting a small subset of customers.

Cause

This issue is related to an AMSI rules rollout that took place on 9th February 2021.

Resolution

• The rules have been rolled back as of 11th February 2021 around 6pm ET.
• If blocking continues
  1. Capture a Procmon and all files outlined in Carbon Black Cloud: How to Collect Process Monitor Logs (Windows)
  2. Open a case with Carbon Black Technical Support